CVE-2026-94107: NivoCart through 2.4.0 Predictable Administrator Password Reset Token

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-20 · updated 2026-09-22
Weakness: CWE-338

Description

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Affected products

nivocart: through 2.4.0

References

https://github.com/nivocart/nivocart
https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34
https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123
https://github.com/nivocart/nivocart/issues/25
https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token

Get alerted when CVE-2026-94107 or the next vulnerability affects your stack